Africa File

Africa File: Al Qaeda–Linked Militants Take Control in Northern Mali 

[Notice: The Critical Threats Project frequently cites sources from foreign domains. All such links are identified with an asterisk (*) for the reader’s awareness.]

To receive the Africa File via email, please subscribe here. 

Key Takeaway: Al Qaeda’s Sahel branch, Jama’at Nusrat al Islam wa al Muslimeen (JNIM), is filling the security vacuum in northern Mali following the French withdrawal in 2022. JNIM is establishing itself as the primary partner and power broker for former rebel groups and communities in the north, an area where the Malian government has historically lacked presence. These communities face rising violence from both the Islamic State and the Russian Wagner Group, which partners with the Malian government. This trend will likely lead to JNIM establishing de facto control over northern Mali, a takeover that will feed long-term instability in Mali and its neighbors and increase the resources and opportunities available to al Qaeda in Africa.

The French withdrawal created a security vacuum in northern Mali. The end of France’s counterterrorism mission in November 2022 significantly reduced counterterrorism pressure that had disrupted the Salafi-jihadi militants’ freedom of movement. The Malian government has remained largely absent from northern Mali. The United Nations Multidimensional Integrated Stabilization Mission in Mali (MINUSMA) is not designed to serve an active counterterrorism role.

The decrease in French counterterrorism pressure has allowed Salafi-jihadi militants greater freedom of movement. The French counterterrorism operation in Mali ultimately failed to end the Salafi-jihadi insurgency in the Sahel. This is largely because French and Western decision makers did not adequately address the sociopolitical and economic causes at the root of the conflict. Still, the French and European counterterrorism forces exerted enough military pressure to eliminate many terrorist leaders, help protect northern Malian cities, and contain the Islamic State affiliate in the area. The mission’s end has emboldened both JNIM and the Islamic State’s Sahel branch. Members of the Islamic State’s Sahel Province—also known as the Islamic State in the Greater Sahara (ISGS)—gathered in large numbers in northeastern Mali in a show of force when pledging to the new IS emir in December 2022. JNIM’s emir, Iyad ag Ghali, traveled throughout northern Mali in 2023 and made his first public appearance in two years in January.[1]

ISGS has capitalized on the lifting of counterterrorism pressure to retaliate against certain ethnic groups and expand its area of operations farther north of the Nigerien border. ISGS has regularly attacked Daoussak Tuareg communities for several years, which led Daoussak militias to partner with French forces in counter-ISGS operations. The French drawdown left these communities without a security partner and vulnerable to ISGS retaliation. ISGS began massacring Daoussak villages and expanding farther north of its typical sphere of influence throughout 2022.

The French withdrawal and its aftershocks have also affected other northern Malian actors with links to JNIM. There are several armed Tuareg groups in northern Mali, most of which fall into three general camps: Salafi-jihadi militants, former pro-separatist rebels, and pro-unionist armed groups. Many of these groups and their leaders have a decades-long history of shared human networks.[2] The Salafi-jihadi groups and pro-separatist groups initially fought on the same side of the northern Mali rebellion in 2012, before the French-led intervention in 2013 helped split the non-jihadist rebels from ag Ghali’s Ansar al Din group. The international community then facilitated an agreement between the various Tuareg rebels and the Malian government in 2015, which remains largely unimplemented. However, ag Ghali has retained contact with the former rebel networks despite their formal distancing.

Dissatisfaction among former pro-separatist rebels has increased with the departure of French forces and the Malian state’s continued absence from northern Mali. Leaders of the pro-separatist factions warned the Malian government that they felt the government was abandoning northern Mali and the 2015 peace agreement as early as July 2022. These leaders escalated by condemning the government’s lack of commitment to the agreement in December 2022 before suspending their participation in the agreement’s monitoring and enforcement mechanisms. The situation has continued to deteriorate in 2023, as the former separatist rebels *withdrew from the Malian constitutional process in January and *left a February meeting with international supporters without consensus on a path forward. The various factions within the pro-separatist movement signed a unification agreement on February 8, indicating that they may be setting conditions to revive their separatist ambitions and even attempt to *carve out an independent state.

The Malian junta has attempted to compensate for its lack of capacity by hiring Kremlin-linked Wagner Group mercenaries, whose presence has increased violence against civilians to the benefit of Salafi-jihadi militants. Wagner Group mercenaries have directly contributed to the spike in violence against civilians and emboldened Malian forces and officials to disregard human rights concerns since their arrival in 2021. Wagner’s atrocities include several collective punishment massacres under the guise of counterterrorism operations that the UN and other human rights experts say amount to crimes against humanity. Wagner’s primary areas of operation have been in central Mali, but the group also has taken over former French bases in major northern towns such as Gao, Ménaka, and Timbuktu (Figure 1).

Figure 1. Areas of Operation—Wagner Group (Mali)

Source: Jules Duhamel, using data from Armed Conflict Location & Event Data Project and Menastream.

JNIM is taking advantage of the deteriorating situation to cultivate partnerships with former rebels and their communities as their only viable protector. JNIM quickly moved to present itself as a security partner and strengthen its ties with Daoussak communities as ISGS attacks approached traditionally JNIM-dominated areas of Ménaka in mid-2022. JNIM and the pro-unionist Daoussak militia groups eventually launched likely coordinated offensives into ISGS-dominated parts of Ménaka (Figure 2). This relationship has continued to deepen. Several Daoussak leaders from Ménaka personally pledged allegiance to JNIM and ag Ghali following January 2023 meetings, formalizing JNIM’s partnership with some Daoussak communities. Ag Ghali also proposed a nonaggression and anti-ISGS pact in meetings with Tuareg leaders in Kidal on January 26, even though ISGS has not yet attacked there.

Figure 2. Salafi-Jihadi Activity and Militia Activity in Northeastern Mali

Source: Liam Karr.

JNIM is also taking on a protector role for northern communities fearing Malian army and Wagner Group violence. JNIM media regularly highlights its attacks on Wagner personnel to pose as a local protector and increase recruitment. Ag Ghali personally promised to protect communities from Wagner and the Malian army in recent meetings with local leaders in northern Mali, despite the limited presence of both forces in the area. The pro-separatist factions have also condemned Wagner’s deployment in Mali.

JNIM has simultaneously increased pressure on central and southern Mali, in a likely effort to preoccupy or even destabilize the Malian junta. JNIM has increased the rate and scale of attacks on security installations around Mali’s capital Bamako in the past year. The group carried out near-simultaneous vehicle-borne improvised explosive device (VBIED) attacks targeting three bases across southern Mali in April 2022, attacked the main Malian army base in southern Mali with another VBIED in June 2022, and began escalating attacks around the capital in January 2023 (Figure 3). These attacks in more politically sensitive areas preoccupy the Malian junta because they are a greater threat to its legitimacy. The military takeover in 2021 stemmed in part from frustration with the previous governments’ inability to contain the JNIM and ISGS insurgencies.

Figure 3. JNIM Intensifies Attacks Near Malian Capital

Source: Liam Karr.

The multifront effort highlights the alignment between JNIM’s subsidiaries. JNIM formed as the merger of four Salafi-jihadi groups with different areas of geographic focus. The subgroup behind the southern offensive is likely the Macina Liberation Front (MLF), which is based in central Mali. Ansar al Din, which Iyad ag Ghali founded, is the active JNIM subgroup in northern Mali. The MLF and Ansar al Din are heavily connected, however. The MLF’s founder was a disciple of Iyad ag Ghali, many of its longtime members fought under Ansar al Din in the 2012 rebellion, and the group initially described itself as Ansar al Din’s “Fulani branch” in 2016, referring to its recruitment among the Fulani ethnic group. The MLF’s offensive has complemented Ansar al Din’s efforts in multiple ways and has helped distract the Malian government from JNIM’s advances in the north. JNIM media has also highlighted the MLF’s attacks in the south as another challenge to the Malian government.[3]

JNIM’s growing partnerships in northern Mali will likely result in the group exerting significant political and military control over the area. JNIM is quickly emerging as the primary power broker in the north. Northern communities will likely have no alternative but to continue some form of cooperation with JNIM, even if the short-term ISGS or Wagner threats subside. The differences and rivalries between JNIM and the various Tuareg factions will likely limit their cooperation, but the fissures between pro-unionist and pro-separatist groups will likely prevent any potential anti-JNIM front without an external driver. JNIM’s influence will likely extend to urban areas of northern Mali for the first time since 2013 in this scenario.

MINUSMA’s presence has been crucial to securing population centers across northern Mali and has helped facilitate what limited central governance and implementation of the 2015 agreement has occurred. The Malian junta has repeatedly undermined MINUSMA, however, which will likely eventually lead the mission’s withdrawal, allowing JNIM free access to urban centers. A collapse of the 2015 agreement would also most likely force a MINUSMA withdrawal and cause a similar outcome.

JNIM would likely use sanctuaries in northern Mali to strengthen its campaign to undermine the Malian government in central and southern Mali. The group will likely be able to use the north as a testing ground for more sophisticated capabilities. It has already begun deploying new technology and tactics against ISGS, such as armored VBIEDs and in-battle drone assistance. JNIM would likely be able to divert these new capabilities and additional resources to support efforts like the MLF’s ongoing campaign in southern Mali with its northern theater secured. These capability boosts would enable JNIM to carry out sophisticated attacks in the south—like its April 2022 VBIED wave—more regularly. The group could also turn these capabilities toward urban areas. It *threatened to target population centers in April 2022 and may have plotted an attack in Bamako in late April. An uptick in attacks in these politically sensitive areas would increasingly undermine the Malian junta’s legitimacy and destabilize the country.

A JNIM-controlled northern Mali may also become a haven for cells plotting transnational terror attacks. In a long-term worst-case scenario, JNIM could use these havens to cultivate transnational attack capabilities. Past patterns show that groups can rapidly pivot from local to transnational aims and that numerous factors push local groups to pursue or support transnational attacks. JNIM will likely not pursue transnational attacks in the short term, but the group has continued to encourage global attacks and never disavowed external terror attack plotting.

In a more likely scenario, JNIM will use northern Mali to support al Qaeda’s activities in neighboring regions, such as the Gulf of Guinea or North African states. JNIM-linked militants are increasingly active in the Gulf of Guinea, and the group may look to increase its efforts to capitalize on local grievances in the northern regions of these countries. JNIM also remains an affiliate of al Qaeda in the Islamic Maghreb (AQIM) and has incorporated some former AQIM elements into its coalition. These links would likely lead it to support or even facilitate future al Qaeda–linked efforts to capitalize on any opportunities that arise from instability in North Africa.

Africa File: Wagner Group in Burkina Faso Will Help the Kremlin and Hurt Counterterrorism

[Notice: The Critical Threats Project frequently cites sources from foreign domains. All such links are identified with an asterisk (*) for the reader’s awareness.]

To receive the Africa File via email, please subscribe here. 

Key Takeaway: The Kremlin-linked Wagner Group will likely deploy to Burkina Faso in the coming months. Military juntas in Burkina Faso and neighboring Mali have sought to partner with Wagner to protect their regimes and mitigate the departure of Western counterterrorism forces. The Kremlin uses its partnerships with African countries to evade sanctions and advance strategic objectives such as countering Western influence and reestablishing Russia as a global power. Wagner’s priority is plunder, and it will likely stoke rather than suppress terror threats by increasing violence against vulnerable populations, thereby driving support to al Qaeda and Islamic State militants.

The Kremlin-linked Wagner Group will likely begin operating in Burkina Faso in the coming months. Wagner has likely aimed to operate in Burkina Faso for years. Russia has increased its military ties to Burkina Faso with several *military deals since at least 2017. Russian-linked activists and pro-Russia parties in Africa have condemned France and called for Russian intervention in Burkina Faso for the past several years. Russia also began a more concerted anti-Western information campaign as early as November 2021 that encouraged Russian military intervention.

These Russian information operations contributed to two successive military takeovers in Burkina Faso, yielding the current anti-French junta. Rising anti-Western sentiment and frustration with the lack of progress against Salafi-jihadi militants led to a coup in January 2022. Several Western outlets reported that the Burkinabe military’s desire to sign an agreement with Wagner was among the coup’s causes, but a deal did not materialize at that time. US intelligence nevertheless assessed in July 2022 that Burkina Faso was still most likely Wagner’s next target. The new junta’s lack of progress prompted another coup that led to a more overtly anti-French junta taking power in September 2022. Wagner Group head Yevgeny Prigozhin *praised the new junta leader immediately after the coup, indicating Wagner recognized the coup as an opportunity. Wagner’s role in the Russian invasion of Ukraine likely forced it to further delay its plans, however. The group temporarily closed recruitment to Africa in October 2022 to send all new recruits to Ukraine.

Russia and the Burkinabe junta began preparing for Wagner’s likely imminent deployment into Burkina Faso in December 2022. The Malian junta facilitated two meetings between Burkinabe and Russian officials, including an undisclosed visit by the Burkinabe prime minister to Moscow. The Burkinabe junta then severed most of its ties with France in January. It requested the removal of the French ambassador at the beginning of the month before formally renouncing Burkina Faso’s military agreement with France on January 24. The junta gave the nearly 400 French soldiers in the country a month to withdraw. On the Russian side, Wagner reopened recruitment to Africa in early January 2023. This move could be to help staff a potential deployment to Burkina Faso. Several sources have claimed a few Wagner personnel arrived in Burkina Faso in late December to finalize a broader deployment with the Burkinabe junta.

The prelude to Wagner’s likely entry into Burkina Faso parallels the group’s entry into neighboring Mali in 2021. In both cases, military cooperation agreements and yearslong information operations increased pro-Russian feelings among citizens and the military. Anti-French juntas eventually rose to power amid frustration over the lack of progress against Salafi-jihadi militants and rising anti-Western sentiment. These factors led military leaders to sever ties with France in favor of Wagner and Russia.

The Burkinabe and Malian juntas have sought to partner with Wagner to protect their regimes. Both juntas courted Wagner as an alternative security partner, believing Wagner’s militarized security approach is more effective than Western assistance. These regimes likely think Wagner will better secure the juntas’ survival because the group can provide regime security support without preconditions for protecting human rights and returning to a democratic system. Wagner also helps the juntas satisfy the anti-Western sentiment among their supporters.

Russia uses its partnerships with African countries’ juntas to evade Western sanctions. Wagner operates in four other African countries besides Mali and Burkina Faso: the Central African Republic, Libya, Madagascar, and Sudan (Figure 1). Many of these governments pay Wagner by granting them access to valuable natural resource deposits, such as gold, oil, and chromite. These natural resources help Russia mitigate the effect of Western sanctions for its invasion of Ukraine. Wagner is likely pursuing gold in Burkina Faso, the fourth-largest gold producer on the continent. The Ghanaian president already claimed the Burkinabe junta gave Wagner access to a gold mine in southern Burkina Faso in December 2022. Russia’s preexisting mines in Burkina Faso are owned by Nordgold, which has struggled under Western sanctions.

The Kremlin also uses these partnerships to advance its strategic goals of countering Western influence and reestablishing Russia as a global power. These relationships help Russia expand its military footprint through Wagner deployments and other military deals. The partnerships also provide Russia with potential votes to help it escape isolation in international bodies such as the United Nations, which Russia used as a component of its international political strategy following its invasion of Ukraine. Russia has explicitly targeted France and its former colonies—such as Mali and Burkina Faso—as part of this strategy.

Figure 1. Wagner Natural Resources Portfolio

Source: All Eyes on Wagner.

Wagner Group will focus on regime security and money laundering under the guise of counterterrorism, increasing violence against civilians and benefiting Salafi-jihadi groups. Wagner Group has increased the amount of violence used against civilians in neighboring Mali since it arrived in 2021, including carrying out collective punishment massacres that it brands as counterterrorism operations. These human rights abuses strengthen the Salafi-jihadi groups by providing a free recruitment tool that drives targeted communities to partner with jihadists for protection. Wagner has likely contributed to the spread of al Qaeda–linked militants across Mali by spreading these abuses and hastening the withdrawal of more capable Western forces.

Wagner will likely bring these same counterproductive tactics to Burkina Faso, where it will exacerbate preexisting trends that have allowed Salafi-jihadi groups to thrive. The Burkinabe junta is significantly expanding a volunteer militia force that many have accused of reinforcing ethnic ties and increasing abuses against civilians. Wagner’s arrival will increase ethnic violence by spreading the group’s brutal tactics and upsetting local dynamics, risking reinforcing ethnic militias’ worst instincts and further militarizing Burkinabe society. The Burkinabe junta has also already pushed out more capable French forces to make way for Wagner and is worsening its relationships with regional allies and the West. Salafi-jihadi militants will take advantage of the increasing violence and chaos to recruit more marginalized civilians and take advantage of likely security gaps left by dwindling Western counterterrorism support.

Africa File: Islamic State Affiliate Attempts to Assassinate Nigerian President

[Notice: The Critical Threats Project frequently cites sources from foreign domains. All such links are identified with an asterisk (*) for the reader’s awareness.]

To receive the Africa File via email, please subscribe here. 

Key Takeaway: The Islamic State’s West Africa Province (ISWAP) likely attempted to assassinate the Nigerian president. The group claimed responsibility for a December 29 vehicle-borne improvised explosive device (VBIED) in central Nigeria. This attack marks ISWAP’s first documented attempt to assassinate Nigeria’s head of state and its first VBIED detonation outside of northeastern Nigeria. These inflections continue an expansion of ISWAP activity in central Nigeria, including its first attacks in the Federal Capital Territory in 2022. ISWAP poses a growing threat to central Nigeria and the country’s capital, Abuja, and will likely continue to escalate operations in early 2023—which could include pursuing international targets in Abuja and attempting to destabilize the country as the February 2023 general elections approach.

Figure 1. The Salafi-Jihadi Movement in Africa: January 2023

Source: Kathryn Tyson.

Islamic State West Africa Province (ISWAP) detonated a bomb targeting the Nigerian president in central Nigeria. Militants *detonated a vehicle-borne improvised explosive device (VBIED) near the Ohinoyi Palace in Okene, Kogi State, on the morning of December 29. The explosion killed at least four people. ISWAP claimed the attack on January 2, saying it targeted the “apostate Nigerian tyrant”—a label likely referring to Nigerian President Muhammadu Buhari.[1] Buhari was in Okene to commission a hospital near the palace on the morning of the attack. ISWAP may have intended to kill Buhari but mistimed the explosion. Alternately, the timing of the attack may have been intended to threaten Buhari while attempting to avoid provoking a large Nigerian military response.

This attack indicates that the ISWAP cell based in Kogi State has increasing ambition and sophisticated capabilities. The Kogi cell is ISWAP’s most active cell outside of northeastern Nigeria. It carried out at least 10 *attacks across Kogi and neighboring states in 2022, mostly ambushing security force convoys, attacking police posts, and detonating improvised explosive devices in civilian areas. The December 29 attack is the Kogi cell’s first use of a VBIED. The attack is also ISWAP’s first use of a VBIED outside of ISWAP’s strongholds in northeastern Nigeria and the group’s first demonstrated effort to target a head of state.  

The Kogi cell may attempt to use its VBIED capabilities in Nigeria’s capital region or even the capital itself. ISWAP increased activity around Abuja in 2022. ISWAP carried out a complex prison break in the Federal Capital Territory in July 2022 that freed hundreds of prisoners. The Kogi cell’s primary area of operations is roughly 125 miles from the capital, and the group was likely *involved in this July 2022 prison break, showing it can assist operations near Abuja. The cell has now shown it can manufacture VBIEDs that it could use in future attacks. ISWAP was also likely behind a credible threat that led to the evacuation of nonessential personnel and family from the US embassy in Abuja in October 2022. The Okene attack and the October embassy threat demonstrate ISWAP is working to penetrate higher security areas to attack high-level Nigerian and international targets. Attacks in Abuja could be especially destabilizing as the February 2023 Nigerian general elections approach.

Figure 2. ISWAP Attacks in Central Nigeria

Source: Liam Karr.

The Kogi cell will escalate operations in early 2023. The cell may be reactivating after a lull in activity during record-high seasonal flooding in its area of operations. ISWAP and the global Islamic State organization may also be increasing propaganda focus on the cell. IS media circulated a video of fighters in Kogi pledging allegiance to the new IS caliph on December 5. This pledge is the first from an ISWAP cell outside northeastern Nigeria. IS media then disseminated the cell’s first attack claim since October, on December 23.[2] ISWAP and IS could encourage attacks on higher-value targets or seek more spectacular attacks to highlight in its propaganda. ISWAP could seek to coordinate such attacks with a global IS revenge campaign in response to the death of the group’s leader in October. ISWAP has participated in previous revenge campaigns. A revenge campaign could coincide with an attack surge during the holy month of Ramadan in March and April 2023. IS has coordinated Ramadan attack campaigns in the past.

The Kogi cell highlights ISWAP’s growing threat outside of northeastern Nigeria. ISWAP has become more internationally minded and capable than Boko Haram, in part due to the benefits of participating in the IS network. ISWAP expanded its operations from its havens in northeastern Nigeria in 2022 and claimed attacks in 10 states. The group generated a credible terror threat to Abuja and the US embassy for the first time since 2017. Its connections to the Islamic State network also bring it millions of dollars and veteran trainers. Its Islamic State links further encourage the group to attack high-level targets, acting as the Islamic State’s vanguard for *global jihad on the African continent.

ISWAP’s expansion strains the already overstretched Nigerian security forces. The Nigerian government also faces a banditry crisis in the northwest, a separatist insurgency in the southeast, and farmer-herder tensions across the country. These overlapping security challenges feed each other. Salafi-jihadi factions and other armed groups may pursue limited cooperation, multiplying their capabilities and geographic reach. An unstable Nigeria threatens the future of West Africa and the entire continent. Nigeria is the most populous country in Africa and will overtake the US as the third most populous country in the world by 2050. It also has the continent’s largest GDP and plays a key role in regional peacekeeping efforts.

For additional analysis on ISWAP in Nigeria, see “A Global Terror Threat Rises in Nigeria” by Emily Estelle Perez and Liam Karr and “Islamic State Prison Break Signals Expanding Salafi-Jihadi Threat in Nigeria” by Liam Karr